Files
stack/docs
Jason Woltje a9254c1bd8
Some checks failed
ci/woodpecker/pr/woodpecker Pipeline failed
ci/woodpecker/push/woodpecker Pipeline failed
fix(#277): Add comprehensive security event logging for command injection
Implemented comprehensive structured logging for all git command injection
and SSRF attack attempts blocked by input validation.

Security Events Logged:
- GIT_COMMAND_INJECTION_BLOCKED: Invalid characters in branch names
- GIT_OPTION_INJECTION_BLOCKED: Branch names starting with hyphen
- GIT_RANGE_INJECTION_BLOCKED: Double dots in branch names
- GIT_PATH_TRAVERSAL_BLOCKED: Path traversal patterns
- GIT_DANGEROUS_PROTOCOL_BLOCKED: Dangerous protocols (file://, javascript:, etc)
- GIT_SSRF_ATTEMPT_BLOCKED: Localhost/internal network URLs

Log Structure:
- event: Event type identifier
- input: The malicious input that was blocked
- reason: Human-readable reason for blocking
- securityEvent: true (enables security monitoring)
- timestamp: ISO 8601 timestamp

Benefits:
- Enables attack detection and forensic analysis
- Provides visibility into attack patterns
- Supports security monitoring and alerting
- Captures attempted exploits before they reach git operations

Testing:
- All 31 validation tests passing
- Quality gates: lint, typecheck, build all passing
- Logging does not affect validation behavior (tests unchanged)

Partial fix for #277. Additional logging areas (OIDC, rate limits) will
be addressed in follow-up commits.

Fixes #277

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-03 20:27:28 -06:00
..

Mosaic Stack Documentation

Complete documentation for Mosaic Stack, organized in Bookstack-compatible shelf/book/chapter/page structure.

📚 Books

1. Getting Started

Essential guides to get Mosaic Stack installed and configured.

2. Development

Developer guides for contributing to Mosaic Stack.

3. Architecture

Technical architecture and design decisions.

4. API Reference

Complete API endpoint documentation.

📝 Scratchpads

Development notes and implementation details for specific issues:

For New Users

  1. Quick Start
  2. Local Setup
  3. Environment Configuration

For Developers

  1. Branching Strategy
  2. Testing Requirements
  3. Type Sharing

For Architects

  1. PDA-Friendly Design
  2. Authentication Flow (to be added)
  3. System Overview (to be added)

For API Consumers

  1. API Conventions
  2. Authentication Endpoints

📋 Documentation Standards

File Organization

docs/
├── {N}-{book-name}/              # Book (numbered)
│   ├── README.md                 # Book overview
│   ├── {N}-{chapter-name}/       # Chapter (numbered)
│   │   ├── {N}-{page-name}.md    # Page (numbered)
│   │   └── ...
│   └── ...
└── scratchpads/                  # Development notes (unnumbered)

Numbering Convention

  • Books: 1-getting-started, 2-development, 3-architecture, 4-api
  • Chapters: 1-quick-start, 2-installation, 3-configuration
  • Pages: 1-overview.md, 2-local-setup.md, 3-docker-setup.md

Numbers maintain order in file systems and Bookstack.

Writing Style

  • Concise — No unnecessary verbosity
  • Action-oriented — Use imperative mood ("Run the command", not "You should run")
  • Example-heavy — Show, don't just tell
  • Code blocks — Always include working examples
  • Links — Cross-reference related topics
  • PDA-friendly — Follow design principles

Code Examples

Always include:

  • Language identifier for syntax highlighting
  • Complete, runnable examples
  • Expected output when relevant
  • Error cases and troubleshooting

🛠️ Contributing to Docs

Adding New Pages

  1. Identify the appropriate book/chapter
  2. Create numbered markdown file
  3. Add to chapter's parent README
  4. Link from related pages
  5. Test all links and code examples

Updating Existing Pages

  1. Keep formatting consistent
  2. Update last-modified date
  3. Test all examples
  4. Check cross-references

Creating New Books

  1. Number sequentially (5-{new-book})
  2. Create README.md overview
  3. Add chapter directories
  4. Update this index

📊 Documentation Status

Book Completion
Getting Started 🟢 Complete
Development 🟡 Partial
Architecture 🟡 Partial
API Reference 🟡 Partial

Legend:

  • 🟢 Complete
  • 🟡 Partial
  • 🔵 Planned
  • Not started

🔗 External Resources

📧 Support


Last Updated: 2026-01-28 Version: 0.0.1 (Pre-MVP)